SMB: Microsoft Windows SMB Transaction Parsing Code Execution

This signature detects attempts to exploit a known flaw in Microsoft SMB2. A code execution vulnerability exists in Microsoft Windows Server Message Block Version 2 (SMB2) component. The vulnerability is due to an error while handling Write requests. Unauthenticated remote attackers could exploit this vulnerability by sending a specially crafted network message to the affected service. Successful exploitation would result in code execution with SYSTEM privileges.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability that affects the Microsoft Server Message Block (SMB) protocol software. A remote attacker can exploit this issue to execute code with SYSTEM-level privileges. Failed exploit attempts will likely cause denial-of-service conditions.

Affected Products

Avaya messaging_application_server,Microsoft windows_vista

References

BugTraq: 47198

CVE: CVE-2011-0661

URL: http://www.microsoft.com/kb/2508429

Short Name

SMB:OF:SMB2-WRITE-OFFSET

Severity

Major

Recommended

False

Recommended Action

Drop

SMB: Microsoft Windows SMB Transaction Parsing Code Execution

Extended Description

Affected Products

References

Found a potential security threat?